← Back to SOC feed Coverage →

suspicious author

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-05-12T11:00:00Z · Confidence: medium

Hunt Hypothesis

The hypothesis is that an adversary may be using a suspicious author identifier to evade detection or obfuscate their presence within the environment. A SOC team should proactively hunt for this behavior in Azure Sentinel to identify potential evasion tactics and uncover hidden malicious activity.

YARA Rule

rule suspicious_author : PDF raw
{
	meta:
		author = "Glenn Edwards (@hiddenillusion)"
		version = "0.1"
		weight = 4
		
	strings:
		$magic = { 25 50 44 46 }
		$header = /%PDF-1\.(3|4|6)/

		$author0 = "Ubzg1QUbzuzgUbRjvcUb14RjUb1"
		$author1 = "ser pes"
		$author2 = "Miekiemoes"
		$author3 = "Nsarkolke"
	condition:
		$magic in (0..1024) and $header and 1 of ($author*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 6 string patterns in its detection logic.

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/maldocs/Maldoc_PDF.yar